Auto-provisioning
Automatically creates user accounts for new employees and removes them when employments end.
How it works
The auto-provisioning job runs daily and performs two operations:
- Provisions new users for employees whose employment starts on the run date
- Deprovisions users whose employment ended the day before the run date
Configuration
To turn on auto-provisioning, go to and turn on Auto-provision Users .
Auto-provisioning and SCIM provisioning are mutually exclusive — one system manages the user list at a time. Turning on the SCIM provisioning integration switches auto-provisioning off, and the setting stays locked until the integration is turned off again.
Auto-provisioning cannot be turned on in a test workspace. A test workspace usually holds a copy of real data, so a run would send a real invitation email to every active employee in it. The setting is locked there, and marking a workspace as a test workspace switches auto-provisioning off automatically.
Provisioning new users
When an employee’s employment starts, the job creates a user account if:
- The employee has an email address set
- No user already exists for this employee
- No existing user or invitation uses the same email address
Invitation process
- A user record is created with status “Invited”
- An invitation email is sent to the employee’s email address
- The employee clicks the link to set up their password and activate the account
Role assignment
Roles are automatically determined based on the employee’s position:
| Role | Assigned when |
|---|---|
employee | Always assigned (base role) |
manager | Employee is set as manager for at least one other employee’s active employment |
Roles are evaluated at the time of provisioning based on active employments on the start date.
Deprovisioning users
When an employee’s last employment ends, the job removes their access:
- All active sessions are terminated (immediate sign-out)
- The user account is deleted
When deprovisioning occurs
- The employment end date has passed (job runs the day after)
- The employee has no other active employments starting on or before the next day
- This allows for seamless transitions between positions without losing access
What is preserved
- Employee record and personal data
- All historical time registrations
- Time off records and time bank history
The employee can be re-provisioned later if they return with a new employment.
Troubleshooting
| Issue | Solution |
|---|---|
| Job didn’t run | Check that auto-provisioning is turned on under Admin > Workspace |
| Job didn’t run | Check that the workspace is not marked as a test workspace |
| User not provisioned | Verify the employee has a valid email address |
| User not provisioned | Check that no existing user has the same email |
| No invitation email received | Check spam folder; verify email address is correct |
| User not deprovisioned | Confirm employment end date is set and has passed |
| User not deprovisioned | Check for overlapping employments that keep the user active |